Where does a phone keep its identity without a removable SIM?
eSIM keeps the secure chip and removes the need to swap a card. Think of the chip as a locked cabinet holding the mobile operator’s identity information.
Scanning a code tells the phone where to collect that information. The code does not contain the secret key. The phone needs an internet connection and security checks before the protected information can be installed in the right chip.
Installing and enabling are different steps. Once enabled, that information helps the phone prove its identity to the network. Antennas and base stations still carry the messages.
Change one condition and find the stopping point
- Move through installation. Does the installed subscription still need enabling?
- Choose a failed identity check. Where does the process stop?
- After a normal installation, switch between daily and travel subscriptions. Which is active, and which is still stored?
Provisioning and network authentication are separate
Further controls and numerical checks
- Select “Install and enable” and move the step progress. A fully installed travel profile remains disabled until the separate enable step. The daily profile stays stored when travel becomes active.
- Choose an untrusted server certificate. Authentication stops the transaction before binding or installation.
- Send the bound package to a different chip, or modify the package. The existing daily line stays available; a partial travel profile is not enabled.
- Disconnect the internet before download. A download reference does not supply connectivity. This input models a missing initial connection, not mid-transfer recovery policies.
- In a normal “Network authentication” sequence, select the daily or travel profile. The selected identity changes; the antenna does not.
Want to check the technical details?
Think of the secure chip as a locked cabinet and an operator profile as a card kept inside. Scanning tells the phone where to collect a new card. It must pass checks before storage, and be selected before use. Now we can name the cabinet, the card and the helper that carries it.
An eSIM removes the card-swapping step while retaining secure hardware. Follow an eUICC in a consumer phone: a hardware-and-software component that can securely store, install and manage operator profiles. This film depicts a discrete chip soldered to a circuit board; removable and integrated implementations also exist. A profile is the operator’s data and applications, including a network access application such as USIM, a subscriber identity and authentication credentials. Hardware and profile are different objects. GSMA SGP.21 v2.6 defines their roles.
An activation code gives the phone’s Local Profile Assistant, or LPA, download information: which SM-DP+ server to contact and which subscription to request. The QR code does not contain the long-term mobile-network key K. The phone also needs an existing internet connection, such as Wi-Fi, for this download path. A code cannot create radio coverage.
The SM-DP+ and eUICC authenticate through certificates and fresh protocol messages. The server prepares a protected Bound Profile Package, or BPP, cryptographically tied to the intended eUICC. The LPA downloads and forwards the package in segments. Protected processing and installation take place at the chip. Copying the same bound package to a different chip does not create another usable SIM. SGP.22 v2.2.2 specifies the protocol and package handling.
Installed does not mean enabled. A downloaded profile is initially installed in a disabled state. After the user enables it, the baseband uses the selected profile for mobile-network registration and authentication. The network sends a random challenge; the chip computes a response using its credentials. During authentication, the key is not transmitted as a radio message. eSIM changes how a subscription reaches the device; the baseband, antenna and mobile network still carry the communication.
What do EID, ICCID and IMSI identify?
EID identifies the eUICC, ICCID identifies a profile, and IMSI identifies a subscription in an operator network. They serve different purposes; a phone number cannot stand in for all of them. The film uses symbols such as “A”, “daily” and “travel”, with no real activation tokens, subscriber numbers or keys. A padlock marks a protection boundary rather than displaying secret material.
Consumer provisioning uses certificates, public-key cryptography and protected packages. Later mobile-network authentication uses the profile’s network credentials and the relevant 3GPP procedure. A download-server certificate is not the network key K. The international roaming explanation develops challenge-response authentication and the home network’s role.
Can only one profile be enabled?
This diagram uses a traditional single enabled port: multiple stored profiles, one selected at a time. It is not a universal limit for modern phones. Dual-eSIM and multiple-enabled-profile devices can combine additional ports with baseband and operating-system capabilities. Apple’s Dual SIM guide, for example, identifies devices supporting two eSIMs. Real limits and availability depend on the device, region and operator. Storage capacity and simultaneous enabled lines are separate questions.
What does this teaching model leave out?
It follows the activation-code path in consumer GSMA RSP. It does not expand SM-DS discovery, device transfer, commercial subscription activation, confirmation codes, recovery or other optional paths, and it does not depict the unattended IoT procedure in SGP.32. Eight visual segments are not a real APDU count, file size or download-speed estimate.
The independent state machine enforces authentication, binding, complete reception, installation and enable dependencies. Certificate and integrity checks are represented as protocol outcomes. No production signing, key agreement, decryption or operator service runs here. The original engineering cutaway is not a reconstruction of a particular phone, and its enlarged chip is not drawn to physical scale.